Solved

exchange 2007 logs filling up at a serious rate

Posted on 2010-08-13
29
745 Views
Last Modified: 2013-11-30
Anyone any troublsshooting tips on why exchange 2007 logs are eating my disk space
i have enabled circular logging so it wont eat all my disk space
it was eating around 4gig of disk space in around half a day my database size is around 250gig
im worried that there may be a more serious issue that im not seeing
there is nothing in the event logs
what could be causing this
0
Comment
Question by:dougdog
  • 10
  • 8
  • 2
  • +6
29 Comments
 
LVL 28

Accepted Solution

by:
sunnyc7 earned 250 total points
Comment Utility
a) Take a full backup using Veritas BackupExec and flush the logs.

Why are logs filling up > because you didnt take a backup.
When you take a full-backup logs are flushed and the logs are committed to the database. (EDB's keep a track of the log sequence). This is used for restoring the EDB's from backups, if they get corrupted.
0
 
LVL 22

Expert Comment

by:mutahir
Comment Utility
Are you Backing up Your Exchange server with a Exchange Aware Backup Product ?

Symantec Backup Exec and Symantec Backup Exec 2010 will flush logs (if the option is selected) after a full backup.

---

With circular logging it will prevent you from doing incremental backups of the Exchange store.

Recommended is to have logging and do Full backups of Your Exchange DB.

What backup application you are using ?
0
 
LVL 22

Expert Comment

by:mutahir
Comment Utility
Logs reflect the activity on your mailbox database - high email traffic - high number of logs.
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 250 total points
Comment Utility
You should only ever use circular logging if you dont value your data, or where perpahs ita a replica of data sfaely stored and backed up elsewhere, is all other cases DONT USE IT.

Do a proper (FULL) backup. using windows backup or another exchnage aware backup tool, on a regular basis and the transcation logs will be truncated automatically
0
 

Author Comment

by:dougdog
Comment Utility
commvault and taking a full backup every night but it never flushes the logs
but it is the rate at which the logs are filling the disk
i had to remove the logs manually the long names ie E00002D3F66.log
but straight after removing them in a few hours 3-4gig has been used again
surely this is not normal
0
 
LVL 70

Expert Comment

by:KCTS
Comment Utility
What are us using to do the backup - was ikt designed for exchnage 2007 ?
NEVER manually remove logs!!!
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
Commvault is the hardware.
What software are you using to take the backups to commvault.

Are you taking full backups or incremental ?
Did you set the logs to be flushed ?

here's a screenshot guide
http://www.solutions.pro/how-to-configure-backup-exec-to-purge-exchange-email-logs-123/
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
a) NEVER manually remove logs.
b) CIRCULAR logging NO WAY.

It creates more problems than it solves.
0
 

Author Comment

by:dougdog
Comment Utility
commvault is the backup software
0
 
LVL 20

Expert Comment

by:SatyaPathak
Comment Utility
I Would suggest you take a complete Exchange Backup before doing any thing.

1. Create a New store and move all mailbox to new store One by one.
2. You can also do if you are not intersted to create a new store Just dismount the Store and Ran Eseutil /Ms command and caluculate the total white space.

3. Some time the Exchange database size automaticaly growing.

Its beter You should check white space and either you move all mailbox to new store.

Or You can should ran defrage and Isinteg.

 
0
 

Author Comment

by:dougdog
Comment Utility
is this rate of growth normal
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
4 GIG disk space in half a day > how many users do you have ?

i once had a client where a particular user X kept receiving 300 + emails from one of their clients.
Turns out on the clients outbox a message was stuck and trying to deliver.

That filled up the logs and dismounted the store.

I am trying to find a commvault guide which flushes logs, but cant seem to find one yet

This is what I have
http://documentation.commvault.com/commvault/release_8_0_0/books_online_1/english_us/deployment/deployment.htm
http://documentation.commvault.com/commvault/release_8_0_0/books_online_1/english_us/deployment/install/exchange_2000_2003.htm#Verify Summary of Install Options
0
 

Author Comment

by:dougdog
Comment Utility
great if i could get commvault to flush the  logs
its version 7 im using
0
 
LVL 10

Expert Comment

by:dhruvarajp
Comment Utility
grant the user that under which the commvault  runs full access on the exchange log file directory
that should flush logs after backup

did you get any altert from the app about not beeing able to delte files ?

i guess access is the issue

Thank you
dhruv
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:dougdog
Comment Utility
not that i have came accross i will go through the backup alerts and check
0
 

Author Comment

by:dougdog
Comment Utility
What exactly is contained in the logs I normally delete them  if I'm seriously stuck for space with no problems
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
Are you saying you normally delete exchange logs ?
That puts your exchange in a highly unstable state > your backups will error out and it cant restore from an existing backup.

did you try a test restore from CommVault into a Recovery Storage Group and see if the database is mounting ?

All other experts also concur on this > never manually remove logs http:#33430551
0
 
LVL 10

Expert Comment

by:dhruvarajp
Comment Utility
you can cut paste them to dirrerent directory (recomended)
what all files can be removed

look at the checkpoint

eseutil /mk against the  .chk file..

look at the waypoint if you have CCR enabled

and cut/paste  all older logs than  waypoint/checkpoint


.. you can delete logs before checkpoint/waypoint however .. may render you in problem in case you have to recover data

best way is to take a online backup.. after finshed
delete all files that are older than when backup completed


Thank you
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
dhruv - any clue on commvault backup steps which flushes logs. I cant seem to find it...
0
 

Author Comment

by:dougdog
Comment Utility
Usually moved to another locationthen deleted
Only twice when the disk completely filled up
No other choice at the time
0
 
LVL 74

Expert Comment

by:Glen Knight
Comment Utility
First of all how many users do you have?

Circular logging has it's place and can be used as a temporary fix for these types of issue.  However it's not a permanent fix.

The chances are you have a corrupt rule, pop3 issue (if you are using pop3?) or simply a mailbox that is designated to receive all NDR messages and/or all ND emails.

Have you got limits set on your mailboxes?

Remember a transaction log is created for every type of message, in and out, external/internal,meeting requests. Etc. Etc.

As already said though, please do not manually delete the log files there is a proper procedure to follow.
0
 
LVL 2

Expert Comment

by:modru
Comment Utility
It sounds like you either have a looping email, rejected email, or someone spamming your system. Most likely it's looping email;

Check the logs. You can also watch the Queue Viewer, see if the same emails are being sent constantly.
This could be a case of someone trying to send very large emails, or someone sending messages to an auto-reply, and then looping back. I've seen instances where someone was Out of Office, a service sent them a message, the auto-reply from OOO sent it back, and the service had an auto-reply on it, thus creating a nasty loop.
0
 

Expert Comment

by:Eskarke3
Comment Utility
This sound like something I just went through.  This is applicable for Exchange 2003, so forgive me if it is not applicable directly to 2007.

Exchange Transaction LOG files are specific to a storage group.  If CommVault and taking a full backup every night but it never flushes the logs, you may have some corruption in your log files.

Solution 1 (if you can create a new storage group)
1. Create a new storage group AND PUT YOUR NEW DATABASES AND LOG FILES IN A NEW LOCATION.  (I'm not screaming, it's just important.)
2. Move all mailboxes to another storage group as your entire storage group is affected.  (this may also reveal corruption in mailboxes)
3. Delete the Storage group from exchange.
4. Delete log files.

Solution 2 (if you have other storage groups, but cannot create more)
1. Move all mailboxes to mail stores in other storage groups. (this may also reveal corruption in mailboxes)
2. Move the DB files and LOG files for the affected storage group to a separate location for safety sake
3. Dismount all mail stores in the storage group.
4. Delete or move the DB files and LOGs for the affected storage group.
5. Mount the storage group to re-create files.
6. Move users back (to setup for step 7)
7. Make sure circular logging is off.
8. Run another full backup and make sure that transaction logs are being cleared.

Solution 3: (Last Resort)
Do the following for one storage group at a time if more than one storage group is affected.
1. Schedule a 6 hour outage and notify users
2. Run a full backup.
3. Consider performing an exmerge WITHOUT THE ARCHIVE OPTION to capture email as a precaution.
4. Create a recovery storage group, add all of your mail stores, and TEST YOUR RESTORE!!!
5. Stop if you are not satisfied with the results.
6. Keep your recovery storage group.
7. Dismount all of your mail stores in the affected storage group.
8. Do not delete, but move your mail stores to another drive or share.
9. Mount the storage group to re-create files.
10. If all goes well, merge the content from your recovery storage groups into your new mail stores.

0
 

Expert Comment

by:Eskarke3
Comment Utility
This sound like something I just went through.  This is applicable for Exchange 2003, so forgive me if it is not applicable directly to 2007.

Exchange Transaction LOG files are specific to a storage group.  If CommVault and taking a full backup every night but it never flushes the logs, you may have some corruption in your log files.

Solution 1 (if you can create a new storage group)
1. Create a new storage group AND PUT YOUR NEW DATABASES AND LOG FILES IN A NEW LOCATION.  (I'm not screaming, it's just important.)
2. Move all mailboxes to another storage group as your entire storage group is affected.  (this may also reveal corruption in mailboxes)
3. Delete the Storage group from exchange.
4. Delete log files.

Solution 2 (if you have other storage groups, but cannot create more)
1. Move all mailboxes to mail stores in other storage groups. (this may also reveal corruption in mailboxes)
2. Move the DB files and LOG files for the affected storage group to a separate location for safety sake
3. Dismount all mail stores in the storage group.
4. Delete or move the DB files and LOGs for the affected storage group.
5. Mount the storage group to re-create files.
6. Move users back (to setup for step 7)
7. Make sure circular logging is off.
8. Run another full backup and make sure that transaction logs are being cleared.

Solution 3: (Last Resort)
Do the following for one storage group at a time if more than one storage group is affected.
1. Schedule a 6 hour outage and notify users
2. Run a full backup.
3. Consider performing an exmerge WITHOUT THE ARCHIVE OPTION to capture email as a precaution.
4. Create a recovery storage group, add all of your mail stores, and TEST YOUR RESTORE!!!
5. Stop if you are not satisfied with the results.
6. Keep your recovery storage group.
7. Dismount all of your mail stores in the affected storage group.
8. Do not delete, but move your mail stores to another drive or share.
9. Mount the storage group to re-create files.
10. If all goes well, merge the content from your recovery storage groups into your new mail stores.

0
 

Author Comment

by:dougdog
Comment Utility
round about 400 users
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
Did you call commvault support about the logs issue ?
It may not be a looping email issue if number of users are ~400.

I'd go with figuring out how to take a full backup and test the restore, which will flush the logs.
@this point commvault is the preferred choice.
0
 

Author Comment

by:dougdog
Comment Utility
what is the best practice in relation to storage group sizes in exchange 2007
0
 
LVL 28

Expert Comment

by:sunnyc7
Comment Utility
didnt quiet get your question @ Best Practice for Storage Group

Here's a complete guide to storage
http://msexchangeteam.com/archive/2007/01/15/432207.aspx
0
 

Author Comment

by:dougdog
Comment Utility
just wondering if it is ok to let the mail database grow over 300gig
now that there is no limits in exchange 2007
i know from a restore point of view it would be better to have a number of smaller databases
but im just wondering if in large databases there is more chance of corruption
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now